SSH Command Builder

What Is SSH Port Forwarding and Why Use a Command Builder?

Secure Shell (SSH) is the industry-standard protocol for encrypted remote access to Linux and Unix servers. While a basic SSH connection is straightforward (ssh user@host), real-world engineering workflows frequently require combining multiple flags — port forwarding tunnels, identity key paths, bastion jump hosts, verbosity levels, and connection keep-alive settings. A single misplaced flag causes connection failures that are frustrating to debug.

This visual SSH Command Builder compiles the correct command string from your selected options in real time, eliminating flag typos and argument order mistakes. The output is a ready-to-paste terminal command covering local forwarding, remote forwarding, SOCKS dynamic proxies, and jump host chains.

SSH Port Forwarding Types Explained

• Local Forwarding (-L localPort:remoteHost:remotePort): Binds a port on your local machine and tunnels traffic through the SSH connection to a host reachable from the remote server. The classic use case is accessing a private database (e.g., PostgreSQL on localhost:5432 of a backend server) from your development machine without exposing it to the public internet. Example: ssh -L 5432:localhost:5432 [email protected]
• Remote Forwarding (-R remotePort:localHost:localPort): Binds a port on the remote server and tunnels traffic back to your local machine. This is invaluable when you need to expose a locally running development server (e.g., localhost:3000) to a colleague or a webhook provider, without deploying to a staging environment.
• Dynamic SOCKS Proxy (-D localPort): Turns your SSH connection into a SOCKS5 proxy server. Configure your browser or application to use localhost:localPort as a SOCKS proxy, and all traffic is routed through the remote server. This effectively lets you browse internal network resources or bypass geo-restrictions as if you were sitting on the remote server.

Jump Hosts and Bastion Servers (-J)

Enterprise and cloud environments often place production servers inside private Virtual Private Clouds (VPCs) with no direct public internet access. To reach them, you must first connect to a publicly accessible bastion host, and then hop to the target server. The modern -J flag (introduced in OpenSSH 7.3) handles this in a single command: ssh -J [email protected]:22 [email protected]. Multiple jump hosts can be chained with commas, e.g., -J bastion1,bastion2.

Key SSH Flags Reference

• -i ~/.ssh/id_rsa — Specify a private key identity file for public-key authentication.
• -p 2222 — Connect to a non-default SSH port (default is 22).
• -C — Enable compression for low-bandwidth connections or slow networks.
• -N — Do not execute a remote command. Useful when the sole purpose is port forwarding.
• -f — Fork the process to the background after authentication. Often paired with -N for persistent tunnel daemons.
• -o ServerAliveInterval=60 — Send keep-alive packets every 60 seconds to prevent idle session disconnection.
• -o StrictHostKeyChecking=no — Disable host key verification. Useful in CI/CD pipelines with ephemeral servers, but should never be used in production.
• -v / -vv / -vvv — Increase verbosity for debugging connection and authentication failures.

Security Best Practices for SSH Connections

Always use public-key authentication rather than passwords. Your private key file must have permissions set to 600 (chmod 600 ~/.ssh/id_rsa) — SSH clients will refuse to use keys that are world-readable. For production servers, disable password authentication entirely in /etc/ssh/sshd_config by setting PasswordAuthentication no. When running background tunnels (-f -N), track the process ID and terminate orphaned tunnel processes to avoid port conflicts.

100% Client-Side Privacy

None of your SSH details — usernames, IP addresses, domains, private key paths, port numbers — are transmitted or stored on any server. The command compilation is done completely in memory within your web browser. You can inspect the network activity using your browser's Developer Tools Network tab to verify that this utility operates entirely offline after the initial page load.